/en/tool/regex-tester/ works Checks in the browser
Enter a pattern and text — matches are highlighted immediately, with group numbers and positions. An explanation appears beside it: each part of the expression is shown on a separate line, with an explanation in Russian of what it does. PCRE, Python, Go, .NET, and Java syntax is translated automatically, and differences between engines are listed. The pattern runs in a separate thread with a time limit, so the tab will not freeze, even with an expression containing nested quantifiers.
The expression is broken down into parts: each line shows a piece of the pattern and what it does. Hover over a line in the breakdown to highlight the corresponding piece in the pattern. The group color here matches its column in the matches table.
How your engine differs from the browser
A table of all matches: position, length, and the contents of each group. You can copy columns individually or export the entire table as a file.
Copy one column
The same pattern, flags, and mode, already inserted into code with the correct quotes, separators, and escaping. No manual rewriting needed.
The pattern runs on strings of increasing length made from a repeating character. If the time grows faster than the length, this expression will eventually hang the process on production text. The check runs in a separate thread: a stuck attempt is stopped, and the page stays responsive.
Not checked
| String length | Parsing time |
|---|
The “Ready-made pattern” row includes email addresses, phone numbers, TIN, SNILS, URL, IPv4 and IPv6, dates, times, HEX colors, UUID, card numbers, domains, and license plates. Each preset fills in both an expression and test text, so nothing needs to be rewritten. Enter your own pattern without slashes around it: not «\/\d+\/g», but «\d+»; set the g flag with the switch.
PCRE (PHP), Python re, Go RE2, .NET, and Java handle named groups, text boundaries, and lookarounds a little differently. Choose your engine—the notation will be translated automatically, and anything that can't be translated will be listed separately below the breakdown for review. The browser runs the expression anyway: the page has no PHP of its own, so there's no point pretending otherwise.
The “Pattern breakdown” section splits the expression into parts and labels each one in plain English: “\d{4} — exactly four digits,” “(?: — groups without taking a number,” “(?<= — lookbehind.” Hover over a breakdown row to highlight the corresponding part in the pattern. If the expression fails to compile, a caret appears below the pattern exactly where the engine stopped.
“Matches” highlights matches and displays them in a table. “List” shows only the matched text, one match per line—a convenient way to extract all addresses from a wall of text. “Replace” shows the complete replacement result. “Split” shows what remains between matches, as with split. The generated code at the bottom of the page changes with the mode.
The match table exports the entire result to TXT, CSV, and JSON—not just the first thirty rows. The “Link to this breakdown” button puts the pattern, flags, text, and replacement string into the page URL. Send the link to a colleague, and they will see exactly the same thing.
The button in the “Pattern stability” section runs the expression against strings of increasing length and plots how the execution time grows. Linear growth means the pattern is safe. A fourfold increase in time when the length doubles indicates quadratic growth. A jump by several times indicates the kind of expression that could eventually take down a server with a request from a form.
engine + pattern + flags + text → matches, groups, and positions
The browser engine executes the expression. PCRE, Python, Go, .NET, and Java syntax is converted to its format: «(?P<name>» becomes «(?<name>», «\A» and «\z» become lookarounds at the text boundaries, «\h» and «\R» become character sets, and the atomic group «(?>» becomes a regular group. Unsupported features—recursion, conditional groups, and possessive quantifiers—are listed below the explanation so you do not discover this in production.
The input data is the same as the default field values: you can calculate it mentally and confirm that the tool is telling the truth.
The pattern breakdown shows seven rows: three groups, each containing “\d” with a repetition count, separated by two hyphens.
The pattern contains three pairs of parentheses, so it has three groups: year, month, and day. Each has its own column and color in the match table.
Each date has 10 characters: four digits, a hyphen, two digits, a hyphen, and two digits.
The first match starts at position 6: the word «Релиз» takes five characters, followed by a space.
The replacement swaps the groups and uses periods instead of hyphens.
3 matches and 3 groups are found. The first is 2026-08-17 at position 6, and group 1 has its own position range, 6–10. After replacement, the first line looks like this: Релиз 17.08.2026, откат 19.08.2026. In the «Ready-to-use code» section, the same pattern is already inside preg_replace with a suitable delimiter.
No, and the page does not claim that. The browser engine executes the expression—without a server, there is nowhere else on the page for it to come from. What actually happens is this: the selected engine's notation is translated into browser notation, and any differences that translation cannot resolve are printed as a list. For example, for Go RE2, the page immediately states that backreferences and lookarounds are not supported at all—that is determined here, not during compilation.
«(?P<name>» and «(?'name'» are converted to «(?<name>», «(?P=name)» to «\k<name>», «\A» and «\z» to lookarounds at the text boundaries, «\Z» to the end of the text with an optional newline, and «\h» and «\R» to character sets. POSIX classes such as «[[:alpha:]]» are converted to regular ranges, the «(?#...)» comment is simply removed, and the atomic group «(?>» becomes a regular noncapturing group. Inline flags at the start of the pattern are moved to switches. All of this is listed below the analysis—nothing is changed silently.
This happens when the engine tries an exponential number of ways to split the string. A classic example is nested quantifiers such as «(a+)+b»: on a string of thirty a characters with no b, the engine can spend hours trying every option. A regular page simply freezes on an expression like this. The «Check for safety» button shows the numbers before the pattern goes into production code.
The pattern runs in a separate worker thread, not on the page's main thread. If it exceeds the allotted time, the entire thread is terminated and a warning appears on the page. There is no other way to interrupt a regular expression: the engine cannot stop by itself.
Remove nested quantifiers and ambiguous splitting. It often helps to replace «(\S+)+» with «\S+», and «(a|a)*» with «a*». It also helps to specify exactly what must not be included: the «[^,]+» class tries fewer options than «.+».
The v flag does everything u does and adds operations on character sets directly inside square brackets: intersection «[\p{L}&&\p{Script=Cyrillic}]», subtraction «[\w--\d]», nested sets, and string properties «\p{RGI_Emoji}». They cannot be used together—only one can be used instead of the other, or the engine will refuse to compile the expression. Browsers have supported the v flag since 2023, and if yours does not, the page will tell you.
The number of positions in the text where the engine tried to start a match. If there are three matches but one thousand start attempts, the engine started parsing at 997 positions and backed out. This is not a problem by itself, but together with a slow match time, it is the first sign that the pattern should be made more specific—for example, by adding a specific character at the beginning instead of a dot.
No. The pattern, the text, and the file you dragged into the field all remain in the browser: processing takes place on your device. The page makes no network requests at all—you can see this in the developer tools. The “link to this analysis” is also built locally: the data is stored in the URL itself and never reaches the server.
Creates passwords of the required length and assesses how difficult they are to crack.
Open